Review of the SEC’s Compliance

with the Freedom of Information

September 25, 2009

O "' '' I CE 0 ".

IN S PE CTO FI G ENERA L MEMORANDUM September 25, 2009

To: Mary L. Schapiro, Chairman

David M. Becker, General Counsel, Office of the General Counsel Mary S. Head , Director, Office of Investor Education and Advocacy From: H. David Katz, Inspector General, Office of Inspector General (Ol ~~

Subject: Review of the Securities and Exchange Commission's Compliance

with the Freedom of Information Act, Report No. 465

This memorandum transmits the U.S. Securities and Exchange Commission ,

OIG's final report detailing the results of the review of the Commission's FOIA function . The review was conducted by the OIG as part of the OIG's continuous efforts to assess management of the Commission's programs and operations and was based on our audit plan.

This report contains 10 recommendations that were developed to strengthen the

Commission's FOIA function and processes. The Office of the Chairman concurred with 8 recommendations that were directed to its office. The Office of the Chairman partially concurred with recommendation no. 3. While this recommendation was directed to the Chairman's office, it was responded to by the Office of General Counsel. The Office of General Counsel also partially concurred with recommendation no. 5 which pertained to its office. Based on the written comments that were received and our assessment of the comments, we revised the report accordingly.

Within the next 45 days, please provide OIG with a written corrective action plan that is designed to address the agreed upon recommendations. The corrective action plan should include infomnation such as the responsible official/point of contact, time frames for completing the required actions, milestone dates ,. , identifying how you will address the recommendations cited in this report, etc.

Should you have any questions regarding this report, please do not hesitate to contact me. We appreciate the courtesy and cooperation that you and your staff extended to our contractor.

I I I..Review of the Securities and ExchangeCommission’s Compliance with theFreedom of Information Act Executive SummaryBackground: The Freedom of Information Act (FOIA or Act), was enacted in1966. It was amended in 1974, 1976, 1986, and most recently, in 2007 to narrowthe scope of FOIA exemptions and the ability of agencies to withhold information.The Act provides that any person has a right to access federal agency records,with certain exceptions, that address issues such as national security andpersonal rights. Pursuant to the Act, the right of access is enforceable in court.Agencies are required under the Act to respond to FOIA requests within 20-working days and to notify requesters of their right to appeal a response thatdenies the request to access records. In a Memorandum to the Heads ofExecutive Departments and Agencies, issued January 21, 2009, PresidentObama directed FOIA to be administered with a “presumption in favor ofdisclosure,” which emphasizes the importance of transparency and openness ingovernment.

Executive Order 13392 “Improving Agency Disclosure of Information” was issued

on December 14, 2005 (Executive Order 13392), and directs federal agencies tobecome more “citizen-centered and results-oriented” in responding to FOIArequests. Additionally, pursuant to the Executive Order federal agencies providethe public with information on their FOIA requests, designate liaisons to interactwith the public, and appoint senior-level Chief FOIA Officers to oversee the FOIAprocess. Executive Order 13392 was followed by the Openness PromotesEffectiveness in our National Government Act of 2007 (OPEN Government Act),which affirmed the requirements of the Executive Order, further limitedextensions to a 20-day time period, and added a new “Office of GovernmentInformation Services.”

At the U.S. Securities and Exchange Commission (SEC or Commission), the

Office of Freedom of Information Act and Privacy Act Operations (FOIA/PAOffice) processes FOIA requests. The FOIA/PA Office receives the initial FOIArequests from the public and then identifies the appropriate Commission office ordivision that has the capability to address the FOIA request. The FOIA/PA Officecoordinates record searches with the relevant Commission offices/divisions toprovide a consolidated response to a requester. The Office of General Counsel(OGC) reviews and makes all Commission FOIA appeal determinations.

Review of the SEC’s Compliance with FOIA September 25, 2009

Report No. 465

Page iiAt the end of Fiscal Year (FY) 2008, the FOIA/PA Office had 27 full-timepersonnel. Although the office’s total FOIA processing costs amounted to $4.29million, it collected $62,466 in processing fees, representing only 1.45 percent ofthe FY’s FOIA processing costs. During FY 2008, the FOIA/PA Office carried-over 6,909 FOIA requests from the prior year, received 9,586 new FOIArequests, processed 15,596 FOIA requests, and reduced its FOIA backlog by 87percent. As a result, 899 FOIA requests were pending at the end of FY 2008.

Objectives: The Office of Inspector General (OIG) contracted with Elizabeth A.

Bunker to conduct a review of the Commission’s FOIA processes andprocedures. The objectives of the review were to assess the:

1. FOIA/PA Office’s compliance with applicable laws and regulations.

2. Coordination with FOIA/PA Office liaison staff, select field offices, and the Office of General Counsel.

3. Commission’s compliance with prior OIG audit recommendations.

This review was not conducted in accordance with the government auditingstandards.

Prior OIG Audit Report. In March 2007, the OIG conducted an audit of theCommission’s FOIA backlog. The audit found that the FOIA backlog wasprimarily caused by a large increase in FOIA requests starting in FY 2003. Theincrease in FOIA requests came from commercial entities for comment andresponse letters that were primarily from the Division of Corporation Finance(Corporation Finance) and the Division of Investment Management (IM).

In total, the March 2007 OIG report made eight recommendations

(Recommendations A - H) to streamline and facilitate the FOIA process and toproactively post information for public access via the Commission’s website. Wefound that Recommendation G, which involved providing access to the FOIA/PAOffice’s FOIAXpress tracking system, has not been fully implemented. We foundthat only two offices (OGC and Corporation Finance) currently use the read-onlyaccess feature of the FOIAXpress database.

The other recommendations in the May 2007 OIG report were either fullyimplemented or the responsible office has demonstrated progress inimplementing the recommendations. Corporation Finance expanded its numberof staff, restructured work processes, and instituted detailed monitoring andreporting systems to ensure review and the posting of comment letters on theSEC website. IM had a smaller backlog, but also added staff and developed atracking system to address its backlog. IM staff are also still in the process of

Review of the SEC’s Compliance with FOIA September 25, 2009

Report No. 465

Page iiiposting the prior years’ FOIA data and continue to post current filings andcomment letters on the SEC’s website.

Results. The OIG found that the manner that the Commission’s Chief FOIAOfficer functioned was not in compliance with the requirements of ExecutiveOrder 13392 or the OPEN Government Act. Prior to our review of the FOIAprogram in connection with this report, the Commission had not defined anyexplicitly stated authorities, responsibilities, or reporting duties for the Chief FOIAOfficer. During the course of this review, the SEC has taken steps to fill the ChiefFOIA Officer position.

Further, we determined that few FOIA liaisons have developed written policiesand procedures for processing FOIA requests. This increases the risk of errorand could result in information being inappropriately disclosed or the SEC couldwithhold information from the public that should be released. Additionally, wefound that the SEC has inadequate or incorrect procedures for disclosingresponsive documents that are not in compliance with Act. We also found thatthere is an insufficient separation of the administrative processes between theinitial FOIA determination and the FOIA appeal process. In addition, SECmanagement has not established any comprehensive management, supervisory,or personnel practices for staff that are responsible for FOIA processing. Wedetermined that SEC management needs to improve the skill set of FOIA liaisonstaff by providing them with FOIA training opportunities, updating positiondescriptions, and revising FOIA liaison staff’s performance standards to includeFOIA liaison duties. We also determined the following:

their level of FOIA responsibilities; • Inefficient retrieval systems, voluminous paper and electronic records, and documents that are not organized for efficient FOIA review contributed to delays in processing FOIA requests; • There are duplicate tracking systems that waste time and hinder the efficient processing of FOIA requests; and • Only three FOIA liaisons in two offices knew they had read-only access to the FOIA request database.

Summary of Recommendations. Our report makes the following

recommendations. The Chairman’s Office shall ensure that the Chief FOIAOfficer has sufficient Commission-wide support to fulfill the responsibilitiesoutlined in the OPEN Government Act and should affirm the importance of theFOIA to its mission. The Chief FOIA Officer shall address existing documentreview practices to enhance the maximum disclosure of responsive information,address the deficiencies identified in this report, and comply with the OPENGovernment Act. The Chief FOIA Officer, in collaboration with SEC managers

Review of the SEC’s Compliance with FOIA September 25, 2009

Report No. 465

Page ivand supervisors, should revise the position descriptions, FOIA response taskdescriptions, and performance standards for the current FOIA/PA staff membersand liaisons. The Chief FOIA Officer should ensure that appropriate FOIAtraining is provided to all Commission staff concerning the responsibility tocomply fully with FOIA requirements. The FOIA/PA Officer should provideassistance to the FOIA liaisons in order to incorporate the FOIAXpress trackingsystem capabilities as appropriate.

The OGC should establish and provide a clear policy to emphasize theseparation of roles and responsibilities between staff members that decide FOIAappeals and staff members that advise, counsel, or process the initial FOIAresponse. To support the proper role of OGC, skills of all FOIA staff should bestrengthened to address the amount and quality of FOIA work demands.

Review of the SEC’s Compliance with FOIA September 25, 2009

Report No. 465

Page vii Background and Objectives

BackgroundThe Freedom of Information Act (FOIA or Act), was enacted in 1966, and iscodified in Title 5 of the United States Code, Section 552. The Act generallyprovides that any person has a right of access to agency records, with certainexceptions. Agency records that are not available to the public through “readingrooms,” may be made available in response to FOIA requests. All United Statesgovernment agencies are required to disclose their records, or portions of therecords, upon receiving a written request, except when the records are protectedfrom disclosure under one or more of the FOIA’s nine exemptions. Pursuant tothe Act, the right of access is enforceable in court. The Act also generallyrequires agencies to respond to FOIA requests within 20-working days and tonotify requesters of their right to appeal a response denying access to records.According to the Act, “if the government can show exceptional circumstancesexist and that the agency is exercising due diligence in responding to therequest,” the court may allow the agency additional time to complete its review ofthe request.

The FOIA was amended in 1974, 1976, 1986, 1996, and in 2007 to narrow thescope of FOIA exemptions and the ability of agencies to withhold information.Each amendment expands the scope of information that is available to the publicby the Freedom of Information Act. Changes implemented in the last decadedemonstrate how Congress and recent administrations have been progressivelymodifying the Act to facilitate public access to agency records.

and required agencies to package information electronically if requested.

Review of the SEC’s Compliance with FOIA September 25, 2009

Report No. 465 Page 1 • Executive Order 13392, “Improving Agency Disclosure of Information,” was issued on December 14, 2005 (Executive Order 13392). Executive Order 13392 promoted a “customer service” orientation to the FOIA by requiring the establishment of public liaisons, clarifying exemptions, and providing tracking numbers for consumers. Executive Order 13392 ordered agencies to designate Chief FOIA Officers and to address the FOIA backlogs of requests. Finally, the Executive Order required that agencies report specific monitoring data such as the number of days to process FOIA requests and appeals, the number of FOIA requests granted and denied, and to report progress in resolving FOIA backlogs.

• The “Openness Promotes Effectiveness in our National Government Act

of 2007,” (OPEN Government Act), modified the FOIA by codifying into law most of the provisions of Executive Order 13392, such as the public liaisons and the Chief FOIA Officer. The OPEN Government Act further limited and defined the 20 day time period to respond to FOIA requests, and added a new “Office of Government Information Services.”

• Most recently, in a Memorandum to the Heads of Executive Departments

and Agencies issued January 21, 2009, President Obama directed that FOIA be administered with a “presumption in favor of disclosure.” A second Memorandum, “For the Heads of Executive Departments and Agencies”, issued March 19, 2009 by Attorney General Eric H. Holder Jr., further underscored the goal of maximum disclosure in response to FOIA requests. Subsequent guidelines emphasized that the presumption of disclosure means that information should not be withheld “simply because [an agency] may do so legally.” Furthermore, when an agency determines that it cannot make a full disclosure, the Memorandum directs the agency to consider if it can make a partial disclosure.

Within the U.S. Securities and Exchange Commission (SEC or Commission), theFOIA processing function is centralized and the FOIA/PA Office processes allFOIA requests. The FOIA/PA Office receives the initial FOIA requests from thepublic and then identifies which office or division within the Commission shouldbe contacted to search for records that respond to the request. Personnel in theFOIA/PA Office coordinate record searches with the relevant Commission officeor division to provide a response to requesters. The OGC reviews and makesFOIA appeal determinations. Personnel in the FOIA/PA Office also record andtrack requests for confidential treatment, provide technical support to OGC in theevent of FOIA litigation, and respond to requests for public information.

As shown in Table 1, Costs, Fees, and Staffing for FOIA/PA, at the end of FY2007 the FOIA/PA Office had approximately 28 full-time personnel, total FOIA

Review of the SEC’s Compliance with FOIA September 25, 2009

Report No. 465 Page 2processing costs were $3.78 million, and the Commission collected $140,106 infees, which was about 3.7 percent of its actual processing costs.Table 1 further shows that during FY 2008 the FOIA/PA Office had 27 full-timepersonnel, its processing costs were $4.29 million and the office collected$62,466 in fees, or 1.45 percent of the FY’s processing costs.

During FY 2007 through 2008, the Commission’s FOIA/PA Office’s achievements

were noteworthy. Overall, the FOIA/PA Office met and exceeded the backloggoals that were established in its “Program Action Plan.” The “Program ActionPlan” was required per Executive Order 13392, and was submitted to theDepartment of Justice. 1 These results were accomplished with no significantchanges in the FOIA/PA Office’s staffing and overall costs. While other divisionswithin the Commission had its staff and resources increased to proactively makeinformation readily available to the public, the FOIA/PA Office reduced itsbacklog and responded to new FOIA requests though neither its staff nor budgetwere increased.

1 The SEC’s “Freedom of Information Act Program Action Plan” was initially submitted to the Department ofJustice and the Office of Management and Budget on June 13, 2006. Revisions were later submitted onOctober 13, 2006 and February 1, 2008.Review of the SEC’s Compliance with FOIA September 25, 2009Report No. 465 Page 3 • Carried over 6,909 FOIA requests that were pending at the end of FY 2007; • Received 9,586 new FOIA requests; and • Processed 15,969 FOIA requests.

At the end of FY 2008, the FOIA/PA Office had 899 FOIA requests that were stillpending.

Table 2: Backlog Reduction

Number of Initial Requests FY 2007 FY 2008 Requests pending at the end of the preceding FY 10,403 6,909 Requests received during current FY 9,070 9,586 Requests processed during current FY 12,564 15,596 Requests pending at the end of the current FY 6,909 899 Source: SEC FOIA/PA Office Annual Reports for Fiscal Year 2007 and 2008

Customer Service Orientation

To further address the Executive Order 13392 requirements, the Commission

established a FOIA Customer Service Center (Service Center) and appointedfour public liaisons in March 2006. The purpose of the Service Center and thepublic liaisons was to assist in reducing FOIA delays, increase transparency, tohelp requesters understand the status of requests, and to assist in resolvingdisputes.

To review the Service Center’s effectiveness, we conducted telephone interviews

with 10 of the Commission’s most frequent FOIA requesters. Our samplepopulation consisted of 8 commercial vendors and 2 journalists. Universally, therequesters praised the politeness and courtesy of the FOIA/PA Office staff andnoted that service improved significantly. Some referred to the FOIA/PA Officestaff by name and emphasized the staff’s helpfulness and responsiveness. Onecommented that while the actual information received was disappointing, the staffwas “wonderful, accessible, and made it clear they were doing all they could.”Another said “they are like family.”

Particularly, we found that many commercial requesters described and

applauded its proactive negotiations with the FOIA/PA staff, whereby therequesters could tailor their requests in order to correctly and efficiently receiveinformation that is actually available. Other requestors agreed to submit multiplerequests in smaller units over a period of time rather than submit a large numberof requests simultaneously to the FOIA/PA Office. These arrangements allowedthe FOIA/PA staff to respond to FOIA requests more effectively. Based on ourinterviews, the commercial requesters reported they were generally satisfied withthe efforts of the FOIA staff.Review of the SEC’s Compliance with FOIA September 25, 2009Report No. 465 Page 4The SEC WebsiteThe SEC’s website and its policies for posting, reviewing, and updating FOIAinformation are consistent with Executive Order 13392. The SEC staffresponsible for maintaining the website has written policies and procedures toestablish performance standards that ensure information is posted on its websiteon a timely basis. A link to the FOIA webpage is easily accessible from the mainSEC website. Updates to the “Frequently Requested FOIA Documents” afeature of the FOIA webpage, are “typically posted within 24 hours of receipt.”We found that the Commission’s website management standards exceed therequirement that quarterly reviews are conducted to assure website informationis current and accurate. Instead, the Commission conducts these reviews everytwo weeks. In 2004 the Commission received an award for the best webpagedesign in the category of “Financial Services.”

ObjectivesBased on our annual plan, the Office of Inspector General (OIG) contracted theservices of Elizabeth A. Bunker to conduct a review of the Commission’s FOIAprocess and procedures. The objectives were to review the:

1. FOIA/PA Office’s compliance with applicable laws and regulations.

2. Coordination with FOIA/PA Office liaison staff, select field offices, and the Office of General Counsel.

3. Commission’s compliance with prior OIG audit recommendations.

Review of the SEC’s Compliance with FOIA September 25, 2009

Report No. 465 Page 5 Findings and Recommendations

Finding 1: The Chief FOIA Officer Did Not Have

Sufficient Authority to Address FOIA The role of the Chief FOIA Officer, as established by the Commission, has not been in compliance with the requirements of Executive Order 13392 or the OPEN Government Act. The Chief FOIA Officer did not have sufficient authority or accountability to address FOIA deficiencies.

Both the Executive Order 13392 and the OPEN Government Act requires federalagencies to appoint a Chief FOIA Officer who has the authority to implement awide range of management and policy objectives to ensure the agency’s FOIAcompliance.

While the Commission’s FOIA backlog was a focus of negative publicity in 2006, 2the role of Chief FOIA Officer was temporarily filled by the FOIA/PA Officer, 3 whofacilitated the Commission’s efforts to reduce the backlog during FYs 2007 and2008. However, the FOIA/PA Officer did not meet the requirements of ExecutiveOrder 13392 because the Executive Order required that the Chief FOIA Officer’sposition be at the “Assistant Secretary or equivalent level.” 4

In 2007, the Commission assigned the Chief FOIA Officer duty as a collateralduty of an Office Director. This person resigned from the position in June 2009,and a new Chief FOIA Officer was designated during the same month. Thisperson is also an Office Director who serves in the Chief FOIA capacity as acollateral duty.

During interviews conducted for this review, some staff indicated that they werenot aware of the Chief FOIA Officer’s role. Of the 25 interviews of FOIA liaisonsthat were conducted (excluding the Chief FOIA Officer), few people were able toclearly state the Chief FOIA Officer’s function. In fact, some Commission’s FOIAliaisons stated they did not know there was such a position or person. The

2 FOIA Bombs Backlog the SEC, August 31, 2007, CFO.com: An Economist Group. http://community.dynamics.com/blogs/financeheadlines.3 The FOIA/PA Officer is an SK-17 position, and heads the SEC’s FOIA/PA Office. This is distinguishedfrom the Chief FOIA Officer position required under Executive Order 13392 and the OPEN Government Act,which is a more senior position and has oversight of not only the FOIA/PA program, but other duties as well.4 Hodes, Scott A., FOIA Facts: Chief FOIA/PA Officers Named, Law and Technology Resources for LegalProfessionals, February 15, 2006, http://www.llrx.com/node/1459Review of the SEC’s Compliance with FOIA September 25, 2009Report No. 465 Page 6person appointed as the Chief FOIA Officer stated in our interview that she wasaware of the lack of visibility in the position, but viewed this relative obscurity asan opportunity to explore the Commission’s compliance to the FOIA with a viewtoward developing a suitable role.

We determined that the position did not have a position description within thepersonnel structure, personnel classification system, or in the Code of FederalRegulations (CFR). Furthermore, the Chief FOIA Officer has not been requiredto submit reports about FOIA operations to senior Commission management.Thus, the authority of the role appeared to rest in the Chief FOIA Officer’spersonal influence within the Commission. Without clear authority andaccountability or without senior management’s recognition, a Chief FOIA Officermay not be effective.

The OPEN Government Act describes a broad set of responsibilities for the ChiefFOIA Officer as follows: “Each agency shall designate a Chief FOIA Officer whoshall be a senior official of such agency (at the Assistant Secretary or equivalentlevel). The Chief FOIA Officer of each agency shall, subject to the authority ofthe head of the agency shall—”

(1) Have agency-wide responsibility for efficient and

appropriate compliance [with the FOIA]; (2) Monitor implementation [of the FOIA] throughout the agency . . .; (3) Recommend to the head of the agency such adjustments to agency practices, policies, personnel, and funding as may be necessary to improve its implementation [of the FOIA]; (4) Review and report to the Attorney General, through the head of the agency; (5) Facilitate public understanding of the purposes of the statutory exemptions . . .; and (6) Designate one or more FOIA public liaisons.”

President Obama’s January 21, 2009 FOIA Memorandum for the Heads ofExecutive Departments and Agencies and the March 19, 2009 Memorandumissued by Attorney General Holder to the Heads of Executive Departments andAgencies, stressed that the Chief FOIA Officers be “active participants in theiragency’s FOIA operations.”

Seeking to enhance the importance of the FOIA within agencies, Congress

requested that the Office of Personnel Management (OPM) submit a report withrecommended changes in personnel policies to enhance the stature ofgovernment employees who are involved in administering the FOIA. 5 Congress

5 OPEN Government Act: §11: Report on Personnel Policies Related to FOIA.Review of the SEC’s Compliance with FOIA September 25, 2009Report No. 465 Page 7requested that the OPM consider changes to personnel policies to providegreater encouragement to employees with FOIA responsibilities includingperformance evaluations, pay, promotions, and training. In its response, theOPM declined to make recommendations, but in recognition of the concernexpressed by Congress and FOIA professionals, issued a letter that stated:

The challenges identified by the FOIA community center

around lack of senior leadership support. These issues are appropriately addressed through management direction and are within the control of individual agencies. 6

It appears this statement is an apt description of the past condition of the ChiefFOIA Officer’s role in the SEC.

During the course of this review, the SEC reconsidered the position of ChiefFOIA Act Officer and created a full-time senior officer level position, for which anew position description was written and a vacancy advertised. 7 Applications forthe position were accepted by the agency between July 14, 2009 and July 28,2009. A review of the position description shows that the responsibilitiesidentified in the OPEN Government Act are now described in the positiondescription. The position description includes agency-wide responsibility forcoordinating the Commission’s FOIA/PA policies and procedures. As a seniorofficer, the Chief FOIA Officer will monitor, report, and advise the head of theCommission concerning FOIA compliance. The position description, if observed,will now meet the specifications of the OPEN Government Act. As of this date,the position has not yet been filled.

Recommendation 1:

The Chairman’s Office shall fill the Chief FOIA Officer position with a qualifiedcandidate and ensure that the Chief FOIA Officer has the appropriate authority toimplement FOIA and to effectively fulfill the responsibilities outlined in the OPENGovernment Act of 2007.

Recommendation 2:

The Chairman’s Office shall communicate on an ongoing basis to Commission

employees and the public the importance of the Freedom of Information Act(FOIA) to the agency’s mission. This can be accomplished by updating theCommission’s FOIA webpage to emphasize the importance of FOIA to the public,

6 Michael W. Hager, Acting Director, United States Office of Personnel Management, December 16, 2008.http://www.accesspro.org/OPM_ReportCongress_121608.pdf7 This position was advertised by the SEC as a “Chief FOIA/PA Officer,” however, in order to avoidconfusion with the SK-17 FOIA/PA Officer, for purposes of this report, we will refer to the senior officerposition the way it was referenced in Executive Order 13392, as “Chief FOIA Officer.”Review of the SEC’s Compliance with FOIA September 25, 2009Report No. 465 Page 8and by issuing an SEC Administrative Notice to Commission employees on anannual basis.

Finding 2: FOIA Processing Practices Need

Improvement There are inadequate or incorrect procedures for determining whether potentially responsive documents exist and how exemptions, such as Exemption (b)(7)(A), are applied, which have the effect of creating a presumption in favor of withholding, rather than disclosure, as required by the FOIA. Few FOIA liaisons have written policies and procedures for processing FOIA requests, thus increasing the risk of errors resulting in the inappropriate disclosure of information, or unnecessarily withholding information.

The Presumption of Non-Disclosure

We reviewed data that measured the Commission’s compliance with the FOIAand found that in all FOIA request disposition categories, the Commission’soverall rate was significantly lower when compared to all other federal agencies.Table 3, FOIA Dispositions by SEC and All Federal Agencies, is based on the2008 reporting guidelines that separate Privacy Act requests from FOIA requestsmaking the data in the table comparable across all agencies. Table 3 illustratesthe SEC’s disposition of FOIA requests in comparison to ”All Federal Agencies,”as reported in the SEC’s Freedom of Information Act Annual Reports for FY 2008(Annual Reports). The table shows that the SEC made “full grants” and “partialgrants” 10.5 and 2.9 percent of the time, respectively. In contrast, “All FederalAgencies” reported making “full grants” and “partial grants” of information 41.8and 18.7 percent of the time, respectively.

Our review of the data summarizing request denials showed that while thepercentage of denials the SEC reported in its FY 2008 Annual Report are similarto the percentages that are reported by other federal departments and agencies,the exemption most cited for denials in other federal agencies was Exemption 6,which protects matters of personal privacy. In comparison, the SEC citedExemption (b)(7)(A), “Interference with Law Enforcement Proceedings” mostfrequently for denials. 8 Below, Table 4, SEC’s FOIA Exemption Denials, showsthe number of FOIA requests that were denied in FY 2007 and 2008 claimingone or more of the nine exemptions. Specifically, the Commission issued 865and 1,192 exemption denials in FY 2007 and 2008, respectively.

The SEC’s FOIA process denied the disclosure of information due to exemption(b)(7)(A) in 67 percent of all FOIA denials in FY 2007 and 66 percent in FY2008. 9 This exemption is most frequently applied to requests for records fromthe Division of Enforcement’s (Enforcement) investigative caseload. Wedetermined that the deficiencies in the SEC’s method of processing FOIArequests may account for the frequent use of the FOIA exemption (b)(7)(A) andmay also contribute to request responses identified as “No Information Found.”These deficiencies initially occurred due to inadequate search capabilities suchas searching for documents in key databases. Secondly, we found thatdocuments are not sufficiently inspected to determine if the information ispotentially responsive and if it can be disclosed. Finally, the volume ofEnforcement’s records prohibits the efficient and timely review of documents.

The steps taken by FOIA/PA Office staff and liaisons to process FOIA requestsfor information from The Division of Enforcement (Enforcement) are as follows:

• A FOIA/PA Office staff member initially conducts a search in available

databases to determine if information is available that is related to the subject of the request. The database for searching investigative files is the Enforcement’s Name Relationship Search Index (NRSI) database.

9 U.S. Securities and Exchange Commission Freedom of Information Act Annual Report for FiscalYear 2007, October 1, 2006 to September 30, 2007 and Fiscal Year 2008, October 1, 2007 toSeptember 30, 2008.Review of the SEC’s Compliance with FOIA September 25, 2009Report No. 465 Page 11 This step is completed in compliance with the procedures that are documented in the FOIA/PA’s office Work Procedures Manual. If the NRSI does not locate a reference to the name of an individual or a company, the request disposition is categorized as “No Information Found.”

• If the NRSI database locates a reference, the FOIA/PA Operations staff

refers the request to the Enforcement liaison who extends the search for potentially responsive information using the Case Activity Tracking System (CATS 2000) database to conduct a more detailed search.

• If the CATS 2000 indicates that the subject of the request is associated with an “open” investigation or if the information in the CATS 2000 is sufficiently detailed, the FOIA liaison will recommend that the information is not released or is not responsive to the request. The SEC’s FOIA response cites the FOIA exemption, which most frequently is (b)(7)(A), and concludes that disclosing the requested information would interfere with Enforcement’s proceedings. Generally, there are no further searches.

• If either the NRSI or CATS 2000 database indicates that a case is open but has no investigative activity or is nearing completion, the Enforcement liaison may contact the case attorney for further information or recommend that the FOIA staff refer the request to a regional office liaison who determines the location of records that are responsive to the request and then estimates the volume of information to be processed. Based on the liaison’s estimate, the FOIA staff contacts the requestor with the cost estimate before proceeding further.

We found that in many cases, this search process actually prevents thediscovery of information that is responsive to FOIA requests. During interviewswe conducted, staff members identified a number of weaknesses in the NRSIdatabase, which is described as an abstracted summary of the information that isavailable in CATS 2000. Repeated studies issued by the GovernmentAccountability Office (GAO) identified ongoing deficiencies and weaknesses inEnforcement’s information systems, including CATS 2000, such as inadequateintegration with other systems for data entry and case record updates. 10 Also, areport the SEC OIG issued in September 2008 revealed that not all Enforcementstaff used CATS 2000 to record investigative activity. 11 The Enforcement’s FOIAliaison, corroborated by a GAO review, established that a weakness in the CATS10 Government Accountability Office (GAO), Greater Attention Needed to Enhance Communication andUtilization of Resources in the Division of Enforcement, 09-358, March 2009. See also GAO Report 07-830,and GAO Report 05-670.11 SEC Office of Inspector General, Survey of Enforcement’s HUB System, Report, No. 449, September 29,2008, p. 12.Review of the SEC’s Compliance with FOIA September 25, 2009Report No. 465 Page 122000 and NRSI systems is that even though a number of investigative cases mayno longer be active, they have not been officially closed in the databases. 12 Theeffect of this weakness is that Enforcement investigations, which for all intentsand purposes, are closed, appear in the databases as open. Therefore, theinitial decision, determining if any response information is available, can be faultybecause searches are conducted using databases that have incomplete andinaccurate information. Thus, searches would show that an Enforcementinvestigation is open when it is in fact essentially closed, so the requested FOIAinformation relating to that investigation could actually be produced.

The second deficiency that contributes to the inappropriate application of FOIA

exemption (b)(7)(A) is based on the SEC staff’s judgment that without the visualinspection of documents, the disclosure of any information (including informationavailable publically) constitutes “interference with law enforcement proceedings.”There is not a well-documented process for reviewing documents to segregatepotentially responsive documents that can be disclosed and, thus, the searchmay not be sufficient—particularly to justify an all-inclusive denial that is basedon FOIA exemption (b)(7)(A). Many decisions concerning the responsiveness ofthe records are inferred broadly from the recorded narratives in the CATS 2000and not by reviewing actual documents.

Notwithstanding Enforcement’s recent efforts to close cases that are inactive,

cases labeled as “open” that show some investigative activity in the CATS 2000are most often presumed to be exempt from disclosure unless the EnforcementFOIA liaison can determine that a case is waiting for payments (e.g., penalties ordisgorgements) and that responsive information--with proper approval--can bedisclosed. Thus, instead of actually reviewing relevant documents relating to theinvestigation that is the subject of the FOIA request, the FOIA liaison relies upona database that does not fully have accurate information and makes the decisionto withhold any and all potential responsive documents in their entirety. Also, wedetermined that insufficient time and attention is paid to determining if a partialFOIA release could be made.

The third obstacle encountered by the Enforcement FOIA liaisons and theFOIA/PA Office staff is the volume and organization of documents that have tobe reviewed, segregated, and redacted to properly process the information that issubject to FOIA exemption (b)(7)(A). Consultations with informationmanagement staff from Enforcement reveal that the volume of information hasincreased beyond the capabilities of the available staff to address FOIA requests.The result is that case records, whether closed, open and inactive, or open andactive, are not consistently reviewed for information that might be responsive toFOIA requests, because an exhaustive search to segregate releasabledocuments is often judged not to be feasible. While the volume of records is

12 GAO Report: 09-358, p. 18.Review of the SEC’s Compliance with FOIA September 25, 2009Report No. 465 Page 13never stated as a basis for a denial, the expense and time that is needed toreview the documents effectively deprives the requester of a legitimate response.

The inadequate review of documents is not limited to documents from

Enforcement. For FOIA requests in other SEC offices/divisions, there are similarprocesses that may also be inadequate. The steps are similar to the processfollowed by the Enforcement liaisons. The FOIA/PA Office analyst sends therelevant office or division a copy of the FOIA request and asks the liaison to replywith the responsive records. If the liaison determines there are responsiverecords, the records are usually sent to the FOIA/PA Office for processing andsubsequent release. If the liaison indicates that there are no responsive records,or that an exemption to the disclosure applies, the FOIA analyst does not reviewthe records to confirm the liaison’s judgment.

Administrative Appeals of Exemption (b)(7)(A)

We also found evidence that OGC supports and defends the practice of limitedand perfunctory document review. 13 We examined 19 FOIA appeal file casesthat were closed during FY 2007 and FY 2008. Our sample of 19 administrativeappeal files included 16 appeals from commercial requestors, 2 from mediarequesters, and a disputed fee charge from an individual requestor. Based onour review, we found 10 examples of legal memoranda that were prepared byOGC attorneys and contained standardized, boilerplate legal explanationsupholding the SEC’s routine application of FOIA exemption (b)(7)(A). The legalmemoranda clearly stated the Commission’s policy as follows:

The appeal file reflects that the FOIA/PA Officer acted

consistently with the Commission’s policy related to requests for information contained in active investigation files. (A footnote further explained: “The FOIA/PA Officer, as is routinely done with such requests, withheld the investigatory information in its entirety.”)

Some appeal case files that OIG examined for this review had notes and copiesof emails that documented OGC attorneys’ attempt to verify the status of a casethat was presumed to be “open,” prior to the appeal being decided. However,there was no record or any affidavit confirming a document review wascompleted, nor verifying that responsive records were withheld “which, ifreleased, could reasonably be expected to interfere with Enforcement’s

13 According to the DOJ’s Office of Information Policy, the SEC received the third highest number ofappeals among all federal agencies and departments that reported FOIA data to the Department of Justicefor FY 2008. Department of Justice Summary of Annual FOIA Reports for FY 2008. The inadequatesearches for responsive documents described above may account for a large number of the administrativeappeals for denied information.Review of the SEC’s Compliance with FOIA September 25, 2009Report No. 465 Page 14proceedings,” neither at the time of the initial FOIA response, nor at the time ofthe appeal.

The FOIA stipulates exemptions from disclosure as:

… records or information compiled for law enforcement

purposes, but only to the extent that the production of such law enforcement records or information . . . could reasonably be expected to interfere with enforcement proceedings. . . .

[Furthermore] . . . Any reasonably segregable portion of a

record shall be provided to any person requesting such record after deletion of the portions which are exempt under this subsection. 14

In our review, we found many cases where no efforts were made to segregateportions of records for disclosure purposes. Accordingly, the effect was apractical presumption in favor of withholding information, rather than thedisclosure as required by the Freedom of Information Act. Of the 1,192exemption denials that the FOIA/PA Office issued in FY 2008, 196 or 16 percentof the requesters filed appeals. In FY 2007, there were 865 denials and 143 (16percent) were appealed. We found that when an initial FOIA decision isappealed, while a thorough review of responsive documents is still notperformed, OGC personnel will at least contact the staff attorney assigned to theinvestigation that is the subject of the FOIA request and obtain oral confirmationon the status of the investigation. However, because only a small percentage ofrequesters challenge the initial denial by filing an appeal, the majority ofrequesters are deprived of this added step that is taken by OGC counselors.

The practice of the SEC not conducting a document-by-document review has

been challenged and has resulted in censure by the courts on two recentoccasions. 15,16 These court decisions reveal the SEC’s consistent pattern ofnon-disclosure expose the Commission to the costs of litigation and negative

14 5 U.S.C. §552: The Freedom of Information Act. (b), The Freedom of Information Act Guide,http://www.usdoj.gov/oip/foia_guide07.htm. March 2007, Printed on June 2, 2009.15 Gavin v. SEC, No. 04-4522 2006 WL 1738417 at *3 (D. Minn. June 20, 2006) wherein the court statedthat the SEC “continually and deliberately stalled in fulfilling its obligations to conduct a document-by-document review of material it seeks to withhold pursuant to Exemption 7(A). In doing so the SEC hasattempted to play by its own rules and [has] disregard[ed] the law.” See Freedom of Information Act Guide,p. 697.16 Aguirre v. SEC, No. 06-1260, 2008 WL 1934342 at *69 (D.D.C. Apr. 28, 2008) the court finds that "therecan be no doubt that the SEC has failed to demonstrate the adequacy of its search." SEC's declaration [ofsearch for responsive documents] "lacks detail and it makes no reference whatsoever to the search terms ormethods used. Instead, it merely states that SEC staff ‘reviewed their work files’ and ‘followed standardprocedures.’’ " http://www.usdoj.gov/oip/foiapost/2008foiapost20.htmReview of the SEC’s Compliance with FOIA September 25, 2009Report No. 465 Page 15publicity. 17 OIG determined that the current SEC practice and policy disregardsthe intent of FOIA to maximize disclosure and, more importantly, negates theprinciple of openness in government that is embodied by FOIA.

Lack of FOIA Policy and Procedures

Of the 19 FOIA liaisons we interviewed, only 2 liaisons provided OIG with anywritten policies and procedures for processing FOIA requests. Most liaisons thatdid not have written procedures indicated that they had extensive experience andwere able to adapt their response to the requests appropriately, though the stepsthat were followed varied. Staff in the FOIA/PA Office provided OIG with theoffice’s procedure manual. A revision of the manual was planned at the time ofthis review. It was supplemented by interim written guidance.

FOIA/PA Office staff believe that FOIA is not a priority within the Commissionand FOIA requests do not receive appropriate attention when they are referred toCommission divisions/offices. Similarly, FOIA liaisons reported that they oftenhave competing priorities or workload pressures that impact their ability toadequately address FOIA requests. Liaisons acknowledged that the FOIA/PAOffice staff has procedures that guide FOIA request processing. However,liaisons are not well-informed about the procedures. Some liaisons developedtheir own informal FOIA practices. Others stated that the process depended onthe nature of the FOIA request. Thus, FOIA processing is variable andinconsistent throughout the SEC.

Absent any formal Commission-wide guidelines and adequate control

mechanisms, we found examples of noncompliance, errors, and confusionamong all FOIA staff in addressing the appropriate release of information. Someexamples and complaints OIG identified were:

17 Morgenson, Gretchen, Deafened by the SEC’s Silence, He Sued, New York Times, May 28, 2006.http://www.nytimes.com/2006/05/28/business/yourmoney/28gavin.html.18 The SEC’s “Freedom of Information Act Program Action Plan” June 13, 2006 and revised October 13,2006 and February 1, 2008, p. 4.Review of the SEC’s Compliance with FOIA September 25, 2009Report No. 465 Page 16 • Compliance with the time limitations requiring request to responses in 20-days; • Lack of opportunity for feedback, review, or approval of the final FOIA responses that are sent by the FOIA/PA Office staff; and • Low priority given to FOIA responsibilities Commission-wide.

Two recent instances demonstrated the negative impact of the SEC’s lack ofclear policies or processes regarding the release of sensitive information thatmay be contained in FOIA responses. In one case, the Commission releaseddocuments before the affected office or division was given the opportunity toreview the redacted releases. The second case involved the release of adocument that was provided directly to a requester by OGC without theknowledge of the affected office or the FOIA/PA Office. The impact of releasingthis information could have potentially impaired an investigation and jeopardizedthe FOIA process.

We conducted interviews with requesters and FOIA customers and found that theCommission’s lack of clarity and commitment to the intent of the Act is obvious.For example, some requesters reported that while the FOIA/PA Office staff wasvery pleasant, their experience with the FOIA process was “overall frustrating.”Not only were requesters concerned about the “misleading” length of time that ittakes to respond to FOIA requests, they also noted the “extraordinary variability”of the service they experienced. Several requesters indicated that the FOIA/PAOffice staff did not inform them about the status of their requests and furtherstated there was “little confidence in the process” or evidence of a “good faitheffort.” Several requestors stated that the FOIA/PA staff members “did all theycould” but they would like to see more “transparency” from the Commission. Onerequestor informed OIG that there were difficulties with the Commission’s FOIAprocess that “bordered on abusive.”

These issues were not equally reported by staff members across theCommission or by all requesters. But, the fact that these issues were raised bythe public, as well as by SEC staff members indicates that there is a weakness inthe FOIA internal controls that puts the Commission at risk. Clear policies,adequate supervision, and specific guidelines are needed to help facilitateeffective and efficient FOIA operations. This further ensures compliance withgoverning laws and regulations, which in turn safeguards the public’s confidencein the Commission.

Recommendation 3:

The Chairman’s Office shall direct the Chief FOIA Officer to ensure that: • Accurate searches are made for responsive information that go beyond information available in the databases,

Review of the SEC’s Compliance with FOIA September 25, 2009

Report No. 465 Page 17 • In the event of a denial to disclose information, documented evidence is provided to certify that there was a document-by-document review to segregate responsive records.

Recommendation 4:

The Chairman’s Office shall direct the Chief Freedom of Information Act (FOIA)Officer to provide guidelines or written policies and procedures for all FOIArelated staff that specifically address the concerns raised in this review, asfollows:

• Discrimination towards some requesters;

• Improperly processing confidential treatment requests; • The lack of consistency in processing requests and applying exemptions; • Confusion in assigning responsibility for redacting confidential information; • Disclosing information without consulting with the FOIA/PA office or the information source(s); • Mismanaging sensitive information; • Failure to comply with the time limitations requiring request to responses in 20-days; • Lack of opportunity for feedback, review, or approval of the final FOIA responses that are sent by the FOIA/PA office staff; and • Low priority given to FOIA responsibilities Commission-wide.

Finding 3: The OGC May Not Provide an

Unbiased Review of FOIA Appeals There is an inadequate separation of administrative functions in the FOIA appeals process that compromises a fair and unbiased review of FOIA appeals. Individuals who participate in making the initial FOIA determination cannot participate in the adjudication of FOIA appeals.

A FOIA requester has the right to appeal decisions that are made by theFOIA/PA Office. The appeal is sent to the FOIA/PA Office and to OGC where itis reviewed and adjudicated within 20-business days. To understand theCommission’s appeal process, we reviewed a judgmental sample of 19 appeal

Review of the SEC’s Compliance with FOIA September 25, 2009

Report No. 465 Page 18files. 19 The sample population consisted of appeals that were submitted by thetypical appellant. All appeal files, except for three, were from commercialrequestors who had appealed the SEC’s initial response. The three non-commercial requestors in our sample consisted of two media requesters, and anindividual requester who was disputing a fee charge.

We issued a survey to FOIA liaisons and found that 60.6 percent identified OGCas a resource for information about the FOIA. The FOIA/PA Office staff andliaisons throughout the Commission told us they often sought advice from OGCconcerning the correct interpretation and application of exemptions during theinitial processing of FOIA requests. The survey also revealed that a number ofFOIA liaisons are attorneys who have the capability (with some training) todecide how to apply exemptions to FOIA responses on behalf of their office ordivision. However, not all liaisons are lawyers and they may not have access tolegal support within their office or division or from the FOIA/PA Office.

We found that some personnel in OGC, who counsel staff during the initial FOIArequest process, may later evaluate the same appeal decision. This results in apotential conflict of interest that raises concerns about OGC’s ability to renderunbiased appeal opinions. Some FOIA liaisons stated that OGC counselors arecareful to provide options and legal considerations without making arecommendation. OGC counselors acknowledge that they may give advice inthe initial FOIA request process, and later make a recommendation on the samematter if the decision is appealed. But OGC counselors argue that they are ableto separate the advice they give in the initial decision from makingrecommendation for appeal determinations. Furthermore, they stated that theycan assess the merits of an appeal independently and objectively even whenthey have given advice on the initial decision. The Associate General Counselstated that he believes that “the practice (of providing advice regarding the FOIA)is not only appropriate, but he encourages it.” Other personnel we interviewedindicated that OGC’s role was necessary because legal expertise was notavailable until recently within the FOIA/PA Office to support the FOIA liaisonsneeding legal advice.

The Administrative Procedure Act 20 that governs the practice and proceedings offederal administrative agencies such as the SEC states as follows:

An employee or agent engaged in the performance of

investigative or prosecuting functions for an agency in a case may not, in that or a factually related case, participate

The “separation of powers” is an administrative principle of safeguards to limit the

authority and actions of staff to ensure accountability, impartiality, and objectivity.We determined that this principle also applies to processing FOIA requests andappeals. Under the CFR, requests for information under the FOIA are directed tothe FOIA/PA Officer. 21 Staff in the FOIA/PA Office, together with Commissionstaff members who are subject matter experts, have the authority to grant ordeny FOIA requests and to determine the proper FOIA exemption. The OGChas “the authority to grant or deny all appeals. . .” 22

The SEC’s current practice of having the OGC attorney that provides advice toinitially deny a FOIA request and then decides the appeal based on his/her ownadvice, compromises the FOIA process and deprives FOIA requesters fromreceiving an impartial and unbiased review during the appeal process. 23

Recommendation 5:

The Office of General Counsel shall provide and enforce a clear policy of theseparation of roles and responsibilities and stipulate that the Office of GeneralCounsel lawyers who provide advice and counsel regarding any initial Freedomof Information Act request shall not participate in the appeal process.

Recommendation 6:

The Chairman’s Office shall direct the Chief Freedom of Information Act (FOIA)Officer to ensure that sufficient legal expertise is available to the Office ofFreedom of Information Act/Privacy Act Operations staff to process FOIArequests in compliance with the Freedom of Information Act, to correctly applythe exemptions, and to provide legal support to Commission staff regarding theAct.

21 17 CFR 200.80(d)(1): Requests for Commission records and copies thereof--22 17 CFR §200.80(d)(6): Administrative Review.23 The OGC points out that under the CFR, OGC is “the Commission’s advisor with respect to legalproblems arising under the Freedom of Information Act . . . .” 17 CFR §200.21 (a). While that is true, theCFR also specifically provides that the Chairman or General Counsel may separate these functions if thelack of a separation would be deemed “inappropriate.” 17 CFR §200.21 (b)(1)(2).Review of the SEC’s Compliance with FOIA September 25, 2009Report No. 465 Page 20Finding 4: FOIA Responsibilities Have Not Been aCommission Priority Commission managers have not applied adequate management, supervision and personnel practices concerning its staff responsible for FOIA processing. These deficiencies include providing training opportunities, and including FOIA liaison duties in position descriptions and performance standards. All Commission staff needs FOIA related training commensurate with their level of FOIA responsibilities.

Issues Faced by all FOIA Staff

The burden to meet the Commission’s obligation to obey the law is incorporatedin the Act and falls mostly on the FOIA/PA Office staff and the FOIA liaisons.Responding to the FOIA requests involves virtually all Commission staff.Requests are physically received and transmitted back through the FOIA/PAOffice staff, but the FOIA liaisons facilitate substantive searches. Liaisons needsubject matter experts (i.e., investigators, analysts, administrators, etc.) who aremost familiar with the information to produce the response to FOIA requests andwho must understand the increasingly stringent requirements of the FOIA.

As the axis of the Commission’s FOIA process, the FOIA/PA Office staff andFOIA liaisons have common observations and challenges that they face inresponding to FOIA requests. These include:

The FOIA Liaisons

The FOIA/PA office staff has successfully developed efficient responseprocesses for the majority of requests that are received, especially in addressingReview of the SEC’s Compliance with FOIA September 25, 2009Report No. 465 Page 21responses to commercial vendors. However, when a request requires additionalconsultation or research, the request is referred to a FOIA liaison. The FOIAliaison’s role in facilitating a timely and appropriate response and returning theinformation to the FOIA/PA Office is pivotal to the Commission’s success inprocessing FOIA requests.

To understand the concerns experienced by the FOIA liaisons, in May 2009, we

distributed a survey to all the SEC’s designated FOIA liaisons and the FOIA/PAOffice staff. There are 40 designated FOIA liaisons that are in 33 Commissionoffices or divisions and 72.7 percent responded to our survey. The FOIA liaisonresponses to the survey revealed the following:

• Eighty-seven percent spend as little as 10 percent and as much as 40

percent of their time processing from 3 to 50 requests each month. 24 For the remaining liaisons, responding to FOIA requests is their full-time role.

Almost all the liaisons’ FOIA job duties and responsibilities are secondary to theirprimary job. The majority of liaisons reported they were not clear on how or whythey were assigned as a FOIA liaison. One liaison reported feeling she was“being punished” when she was assigned to be the FOIA liaison. Many liaisons

24 This estimate excludes the number of FOIA requests processed by three offices/divisions that receivefrom 100 to 500 FOIA requests per month. For FOIA liaisons with a high FOIA request volume, FOIA dutiesmay be their primary job.Review of the SEC’s Compliance with FOIA September 25, 2009Report No. 465 Page 22do not believe that their FOIA role is valued. Another liaison said that “FOIA isthe step-child” of the Commission. Further, some liaisons complained about staffor management’s apathy, the lack of cooperation from colleagues, and staff’sresistance towards FOIA responsibilities.

Liaisons also expressed concern about the FOIA/PA Office staff. Liaisonsreported that FOIA/PA Office staff sometime makes “small but critical” errorswhen referring FOIA requests. There are also questions about the methods thatare used to search databases and public sources in responding to FOIA requeststhat are incorrectly referred to liaisons. In addition, there is concern that theFOIA/PA Office does not have adequate resources to address complex legalquestions. Finally, FOIA liaisons reported that there is insufficientcommunication and feedback between the FOIA/PA specialists and OGCconcerning FOIA decisions to redact, disclose, or deny information, whichexemptions should be applied, and the outcome of appeals.

The FOIA/PA Office Staff

Since 2007, the FOIA/PA Office has reduced its FOIA request backlogsubstantially. Both the FOIA/PA Office staff and liaisons report that the FOIAprocess has improved and both groups appreciate their mutual roles and valueeach other’s friendship and cooperation, yet all agree there are areas that needimprovement.

In May 2009, we distributed a survey to FOIA staff to better assess their

concerns, challenges, and successes. Nineteen of 24 (or 79 percent) of theFOIA/PA Office staff responded to the survey. The FOIA/PA Office staff attributestheir success in managing a large volume of FOIA requests and reducing itsbacklog to good management within the office. They say that streamlinedprocedures and a tracking system, the FOIAXpress, have enhanced the staff’sefficiency. Sixteen of 19 (or 84.2 percent) of the FOIA/PA Office staff reportedparticipating in one or more FOIA-related training opportunities. However, in thesurvey, the respondents also identified the following difficulties they haveexperienced in responding to FOIA requests:

The FOIA/PA Office staff has become an efficient and productive unit. Theyhave successfully negotiated with a majority of the commercial vendors makingFOIA requests to ensure timely and appropriate responses. In FY 2007 and2008 commercial vendor requests accounted for 96.8 and 95.7 percent, 25respectively, of the FOIA/PA staff workload. These successes, in addition toreducing the backlog, were achieved during FY 2007 and FY 2008, though theoffice’s staffing level did not increase. The office effectively uses theFOIAXpress system to manage its FOIA requests and report they are constantlyseeking to improve the overall quality of FOIA processing. However, like theconcerns expressed by the FOIA liaisons, many of the FOIA/PA staff membersobserved that FOIA requests are becoming more complicated and thatrequesters are demonstrating increasing sophistication in their requests.

Subsequently, the OPEN Government Act established more rigorousexpectations such as the time that is allotted to respond to requests, thus placinggreater demands on staff numbers as well as staff’s skills. In recognition of theimpact on FOIA staff, the Act placed special emphasis on the importance ofpersonnel policies. The Act directed the Office of Personnel Management (OPM)to recommend personnel changes that could be made to “enhance the stature” ofgovernment employees involved in administering FOIA. 27 In response, MichaelW. Hager (Acting Director, OPM), in a letter to the Former Vice President Richard25 Special report produced by FOIAXpress and presented by the FOIA/PA Officer, June 17, 2009.26 http://www.usdoj.gov/archive/oip/foiapost/2006foiapost6.htm27 OPEN Government Act: §11: Report on Personnel Policies Related to FOIA.Review of the SEC’s Compliance with FOIA September 25, 2009Report No. 465 Page 24B. Cheney on December 16, 2008, advised that agencies have the responsibilityand the authority to establish employee performance standards, improverecruiting and selection methods, set minimum rates of pay, establish careeradvancement tracks, and determine training requirements. Attorney GeneralHolder, in his March 19, 2009 Memorandum to the Heads of ExecutiveDepartments and Agencies, affirmed the responsibility of all staff to respond toFOIA requests and highlighted the key role played by FOIA professionals.

In the past, the Commission’s response to the FOIA Act may be characterized as“crisis management.” For example, to address the FY 2007 and FY 2008backlog, the Commission achieved important advances in FOIA requestprocessing by creating systems and mobilizing staff in response torecommendations from OIG Report No. 422. However, it appears there was noCommission-wide oversight to address on-going and future needs. As describedby the FOIA staff that is responsible for compliance with the FOIA, managementhas not addressed basic personnel practices, has neglected to develop andprovide training opportunities, and has not addressed staffing needs to meet thecurrent and expected future FOIA demands.

Recommendation 7:

The Chairman’s Office shall direct the Chief Freedom of Information Act (FOIA)Officer to collaborate with the respective office and division managers and theOffice of Human Relations to review position descriptions of current Freedom ofInformation Act/Privacy Act (FOIA/PA) staff and FOIA liaisons to include staff’sappropriate FOIA task descriptions, performance standards, and review paygrades to ensure that they reflect actual FOIA responsibilities and duties.

Recommendation 8:

The Chairman’s Office shall direct the Chief Freedom of Information Act (FOIA)Officer to ensure that appropriate training opportunities are provided to allCommission staff that is appropriate for their level of FOIA responsibilities toeffectively and efficiently process FOIA requests.

Finding 5: FOIA Processing Needs Improved

Information Management FOIA reviews are hindered by the variety of and inconsistencies in databases and record-keeping practices. In addition, there is a lack of clear policies for management of both paper and electronic documents. Further, the OIG Report No. 422 recommended that read-only access to theReview of the SEC’s Compliance with FOIA September 25, 2009Report No. 465 Page 25 FOIA request database should be made available to all FOIA liaisons. At the time of this review, only three FOIA liaisons had been making use of FOIAXpress.

Since 2004, the Commission has taken important policy and procedural steps toaddress the demand that information is made more accessible on the SEC’swebsite. However, the number of FOIA requests has not decreased as wasexpected. Instead, the number of FOIA requests increased by approximately 6percent between FY 2007 and 2008. Over 95 percent of the 8,000 to 10,000FOIA requests that the Commission receives each year are from commercialusers. FOIA/PA Office staff negotiated with commercial vendors to tailor theirFOIA requests so that the data is readily available and to ensure the FOIA/PAOffice staff serve the vendor needs more efficiently. The vast majority of theserequests can be researched quickly. However, the sheer quantity of requestconsisting of 4,143 commercial FOIA requests that were processed in 2007 and8,545 commercial requests that were processed in 2008, consumes the FOIA/PAOffice resources.

The SEC’s Annual Reports that were submitted to the Department of Justice forFY 2007 and 2008 28 identify the median 29 number of days it took the SEC’sFOIA/PA Office to process FOIA requests. The relative amount of effort that isrequired to process these requests is categorized as “simple” or “complex.” Athird category, “expedited” processing, requires that the FOIA/PA Office respondto the requester within 10 rather than the typical 20-days. Expedited processingis infrequently granted. 30

28 SEC Freedom of Information Act Annual Report for Fiscal Year 2007, October 1, 2006 to September 30,2007 and Fiscal Year 2008, October 1, 2007 to September 30, 2008.29 The median is the middle, not the average number. For example, of the numbers 3, 7, and 14, the mediannumber is 7.30 17 CFR, §200.80 (d)(5)(iii): Expedited Processing.Review of the SEC’s Compliance with FOIA September 25, 2009Report No. 465 Page 26Table 5, Median Days Needed to Process FOIA Requests, indicates that “simple”requests took 67 median days to process in FY 2007 and 66 median days in2008. The median number of days it took to process “complex” requests was705 days in 2007 and 570 days in 2008. Interviews with FOIA staff as well asFOIA liaisons reflect the general impression that responding to FOIA requestshas become more difficult to complete within the required 20-working days that isallotted under the Act and even with the additional days that are allowed by lawfor unusual and exceptional circumstances and even though extensions can begiven with the requesters’ permission. The OIG determined that theCommission’s effort to address FOIA requests in a timely manner is notsufficient.

Information and Records Management

Interviews with the FOIA/PA Officer and staff suggest that a number of factorsinhibit the rapid search and review of responsive records. These factors includelarge volumes of documents that must be reviewed, the problematic organizationof documents, locating files from within the Commission’s headquarters and the11 regional offices, files must be retrieved from long-term storage, and files thatmay already have been disposed of, or may be lost.

One of the most frequently requested records are Enforcement’s investigative

files. An initial search to locate investigative files begins with the NRSI database,which may not be accurate. Potentially responsive files maintained in theregional offices must be boxed and shipped to headquarters. Files may be intransit, or have already been transferred to the Branch of Records Management(BRM) for storage. The BRM manages the tracking of records that have beensent to the Federal Records Center. Records can also be retrieved from long-term storage at various Iron Mountain facilities. Records that are sent to storagefacilities require additional time to search and be delivered to the requestingoffice. In most cases, there are no indexes to these paper records.

Interviews with the Commission Archivist and a review of BRM management

reports confirm that the FOIA/PA Office is the single biggest user of the BRM andaccounted for 80 percent of all the requests in FY 2008, for which 68.7 percentwere delivered to the FOIA/PA Office. The FOIA/PA Officer credits the BRM forimproving service in the past two years, but stated that waiting for off-site recordseither from the regional offices or from BRM accounts for much of the time that isused to process FOIA requests.

When files are located, the staff assesses the likely presence of the responsivefiles. According to instructions from an Enforcement Memorandum issued onAugust 20, 1993, investigative files are organized by their content into categoriesA through F. Most of the records such as Category A – “Transcripts,” or

Review of the SEC’s Compliance with FOIA September 25, 2009

Report No. 465 Page 27Category B – “The Commission’s Official Records,” all have specific instructionsto segregate the information into folders and to index the material in order toidentify the information in the folder. Category F is a general category thatcontains records that are “subject to a FOIA request.” The memorandum furtherstates that: “no index is required for (Category F) records.” Lacking any otherorganizational principle, FOIA/PA staff must review Category F records page bypage, to determine what information is responsive for a given FOIA request. Therequested records can range from a small folder to hundreds of boxes of paperdocuments.

Increasingly, documents and evidence that the SEC accumulates are provided inelectronic formats. Interviews with staff in Enforcement and FOIA/PA Office staffsuggest that electronic records are also problematic. Electronic formats oftenexacerbate the volume, as well as the complexity and variety of evidence that isaccumulated in the course of an investigation. For example, Enforcement staffexplained that the entire content of several computers may be submitted assupport documentation for an investigation. Organizing such information in orderto facilitate the retrieval and review of complex and voluminous recordschallenges the FOIA process even further.

The work flow priority for the FOIA/PA Office staff is to process current requestsfirst. FOIA/PA Office procedures indicate that any FOIA request response thatrequires the review of three or more boxes of documents should be placed in amulti-tracked “first-in, first-out” (FIFO) queue, and are processed as staffbecomes available, in the order of receipt and in agreement with the FIFOprocess. Examples of requests containing large volumes of material include arequest (pending since 2005) that consisted of 300 boxes of records and wasonly just completed in 2009. Another request, now under review, contains morethan 245 boxes of records. Currently, there are 17 pending FIFO requests, butonly three requests are being reviewed at this time. Using the FOIAXpress, theFOIA/PA staff periodically sends letters to the requesters confirming theircontinued interest in receiving a response for these requests. Many requesterswithdraw their request for long-delayed FIFO documents.

The FOIA/PA Officer confirms that the current staffing level is not sufficient toprocess FIFO requests in a timely manner. On occasion, staff is diverted tosupport OGC during FOIA litigation, because litigation support supersedes FIFOrequests. While the FOIA/PA Office staff points to the impressive progress thatthey have achieved in reducing the number of pending FOIA requests, theobstacles experienced by the Commission’s record retrieval system and thecumbersome organization of records continues to hinder the Commission’s abilityto respond to FOIA requests in a timely way.

Review of the SEC’s Compliance with FOIA September 25, 2009

Report No. 465 Page 28Access to the FOIAXpress SystemIn 2007, the OIG conducted an audit of the Commission‘s FOIA backlog andissued Backlog of FOIA Requests For Comment Letters, Report No. 422 onMarch 30, 2007. The audit report consisted of eight recommendations(Recommendations A - H) and found, among other things, that the FOIA liaisonsdid not have access to the FOIAXpress tracking system and database. In theaudit report, recommendation G specified that the FOIA/PA Office provide suchaccess to FOIA liaisons in the other offices and divisions who respond to FOIArequests. In its response to the recommendation, the FOIA/PA Office indicatedthat it planned to provide FOIA liaisons with read-only access to the FOIArequest database.

However, Recommendation G has not been fully implemented. Only 3 of 19

designated FOIA liaisons in OGC and the Corporation Finance reported that theyhad read-only access to the FOIA database and use the FOIAXpress regularly tocheck the FOIA cases that are assigned to them. Other liaisons we interviewedstated they did not know they had access to the FOIAXpress and did not knowhow they would use the information to facilitate FOIA work.

Most of the liaisons have developed their own tracking system and logs to aid inmonitoring the progress of FOIA requests and to document actions that weretaken on FOIA requests. Several liaisons used Excel spreadsheets as theirtracking system or log, and indicated that it took a significant amount of time tore-enter data that duplicates information already existing in FOIAXpress. Someliaisons stated they found inconsistencies between their own logs and a year-endreport that was generated by FOIAXpress. Liaisons expressed doubt about theaccuracy of information in the FOIAXpress.

The FOIA/PA Officer stated that all FOIA liaisons were informed that they couldhave read-only access to FOIAXpress, and those who responded receivedtraining on how to download the request information (e.g., FOIA number, name ofthe requester, received date, target date of the request, etc.), rather thanlaboriously re-entering the same data into their own logs. The FOIA/PA Officeracknowledged the FOIAXpress system is not capable of recording informationthat is unique to each office or division, but that much FOIA request data can beexported from FOIAXpress into an Excel spreadsheet. The FOIA/PA Officer saidthere is no software distribution process or special identification or programmingrequired.

Some features of the FOIAXpress system are not clear and may contribute to theliaisons’ mistrust of the system. We noted the following examples:

Review of the SEC’s Compliance with FOIA September 25, 2009

Report No. 465 Page 29 • Tracking numbers from the FOIAXpress system assigned to appeals files differed from the tracking numbers utilized by OGC. Therefore, the file numbers had to be converted in order to locate the correct appeals files.

• The FOIAXpress system’s record of the closing dates assigned to the

appeal differed when compared to the closing dates recorded in OGC files.

The FOIA liaisons reported that the current system for processing FOIA requestsinvolves an email notification from the FOIA/PA Office, coupled with a copy of therequest. The liaison enters the information into an Excel spreadsheet log beforebeginning the search for responsive records, or assigning the search to anotheranalyst within the office or division. The liaisons reported that they were puzzledthat the request might be several days old before reaching the liaison, thusreducing the amount of time available to conduct the search and return aresponse. The liaisons we interviewed did not have a clear understanding of theFOIA/PA Office staff processes, how liaisons could improve their responses toFOIA requests, and the way the FOIAXpress is utilized.

The OPEN Government Act, specifically addresses the timeliness of FOIA

responses. The conditions for “tolling” the time taken by an agency to respond toa request are specifically delineated. Some “unusual circumstances” mayprovide relief from time limitations, but according to the wording of the Act,“exceptional circumstances” cannot include a predictable workload of requests. 31We found that notwithstanding the reduction of backlogs, the FIFO negativelyimpacts the Commission’s record of FOIA request responsiveness.

Recommendation 9:

The Chairman’s Office shall direct the Chief Freedom of Information Act (FOIA)Officer and the Office of Freedom of Information Act/Privacy Act Operations tocollaborate with the Office of the Secretary, the Division of Enforcement, and theOffice of Information Technology to produce a strategy that addressesinformation management obstacles hindering timely and comprehensive FOIAresponses. This strategy should contain concrete recommendations, specifictimelines, and cost estimates and should be presented to the Commission foraction.

31 5 U.S.C. §552(a)(6)(C)(ii) as described in US Department of Justice, FOIA Post,http://www.usdoj.gov/oip/foiapost/2008foiapost9.htm, “Unusual circumstances” occur when there is a needto search or collect records from field offices, voluminous records, or consultation with another agency.“Exceptional circumstances: cannot include “a delay that results from a predictable agency workload. . . .”Review of the SEC’s Compliance with FOIA September 25, 2009Report No. 465 Page 30Recommendation 10:

The Chairman’s Office shall direct the Chief Freedom of Information Act Officerto conduct training that is needed to fully implement the productive and suitableuse of the FOIAXpress tracking and document management system.

Review of the SEC’s Compliance with FOIA September 25, 2009

Report No. 465 Page 32 Appendix II

Scope and Methodology

This review was not conducted in accordance with the government auditingstandards.

Scope. The scope of the review covered Commission FOIA activities during FY2007 and 2008 and involved a detailed review of the policies, procedures, andprocesses that were in place for processing FOIA requests and appeals in aneffort to determine whether they are consistent with FOIA requirements andCommission rules. The review included an analysis of the Commission’simplementation of Executive Order 13392, Improving Agency Disclosure ofInformation, an assessment of whether public guidance regarding FOIA requestsand processing was up-to-date, and whether the Commission’s implementationof the Act was consistent with current requirements as defined in the OPENGovernment Act of 2007 and the recent directives from the Attorney General.We obtained data from the FIOA/PA Office, OGC, Corporation Finance, IM,Enforcement, and BRM.

Methodology. To address the objective to review the FOIA/PA Office’s

compliance with applicable laws and regulations, we fielded a survey via theSEC’s intra-net to the FOIA/PA Office staff in May 2009. 67.8 percent of theFOIA/PA Office staff responded to the survey. We analyzed FOIA/PA Office staffresponses to the survey to identify issues of compliance with FOIA laws, SECregulations as expressed in the CFR and the documented policies andprocedures, and we interviewed 9 of 28 the FOIA/PA Office staff members toconfirm our observations. We reviewed available documentation, includingpolicies and procedures, the FOIA/PA Working Procedure Manual, the SEC’sAnnual Reports to the Department of Justice, and various tracking logs andreports. To review the FOIA Customer Service Center’s effectiveness, weconducted telephone interviews with the Commission’s most frequent FOIArequesters. Lastly, we tested data to determine if information from the FOIA/PAOffice tracking and documentation system, the FOIAXpress was consistent withother reports, tracking systems, and logs.

To address the objective to review the coordination with FOIA/PA Office liaisonstaff, select field offices, and OGC, we sent a second survey via the SEC’s intra-net to all designated FOIA liaisons in all the identified SEC divisions/offices, thefield offices, and OGC. We received a response from 72.7 percent of thedesignated FOIA liaisons to this survey. We analyzed FOIA liaison responses tothe survey to identify issues of compliance with FOIA laws, SEC regulations asexpressed in the CFR and the documented policies and any available writtenReview of the SEC’s Compliance with FOIA September 25, 2009Report No. 465 Page 33procedures. We interviewed 20 of 40 FOIA liaisons in various Commissionoffices and divisions at headquarters and the regional offices to gain anunderstanding of the coordination with the FOIA/PA Office of the Commission’sFOIA process program. We collected and analyzed various tracking logs andreports and gathered information available on the Commission’s intranet. Weinterviewed the four attorneys in the Office of General Counsel responsible forprocessing and litigating FOIA appeals. To understand the Commission’s appealprocess we reviewed selected appeal files.

Internal Controls. We reviewed the existing internal controls that were

considered significant within the context of the FOIA program and the evaluationobjectives. We interviewed personnel from the FOIA/PA Office, OGC,Corporation Finance, and IM, identified and reviewed applicable policies andprocedures, obtained and reviewed available FOIA program documentation, andtested data for compliance with selected policies and procedures.

Prior Audit Coverage. The OIG previously conducted an audit of the

Commission’s FOIA backlog and issued Backlog of FOIA Requests ForComment Letters, Report No. 422, March 30, 2007. The March 2007 OIG reportmade seven recommendations (Recommendation A - E, and H) to streamlineand facilitate the process of proactively posting information for public access viathe SEC website. We selected FOIA liaisons from the Corporation Finance andIM division/office to assess their compliance with OIG Report No. 422. Interviewswith the staff responsible for implementing the OIG recommendations revealedthat except for one, key recommendations have been either fully implemented ordemonstrating progress. Recommendation G directed that the FOIA/PA Officeimplement its plan to provide FOIA liaisons with access to its FOIA requestdatabase, (the FOIA/PA tracking system is FOIAXpress), and although formallyclosed, has not been implemented. We found that only two offices use the read-only access to the FOIAXpress database, OGC and Corporation Finance.

Use of Computer-Processed Data. We used computer-processed data such

as reports generated by the FOIAXpress system, emails, logs maintained inExcel spreadsheet form. To the extent practical, we compared the data withsource documents. We did not perform extensive testing of system orapplication controls.

Judgmental Samples. All staff with FOIA-related responsibilities were offered

an opportunity to respond to the two surveys. We used judgmental samples toselect staff with FOIA related responsibilities for interviews; although all staff whorequested an interview or identified themselves in the surveys were interviewed.We requested a list of the ten most frequent requesters from the FOIA/PA Officerin order to review the FOIA Customer Service Center’s effectiveness and weconducted telephone interviews with all 10 of the Commission’s most frequentFOIA requesters. The sample requester population consisted of 8 commercialReview of the SEC’s Compliance with FOIA September 25, 2009Report No. 465 Page 34vendors and two journalists. To understand the Commission’s appeal process,we judgmentally selected 19 of 554 closed appeal files to review that covered FY2007 and 2008. Included with these 19 were 16 appeals from commercialrequestors, 2 from media requesters, and a single appeal which disputed a feecharge. We analyzed the appeal process, the number of days to completion, thedisposition, and the number and kinds of exemptions cited.

Review of the SEC’s Compliance with FOIA September 25, 2009

Report No. 465 Page 35 Appendix III

Criteria

Freedom of Information Act, 5 U.S.C. §552: Governs the FOIA Program.

The Freedom of Information Act: Amended in 1974, 1976, 1986, 1996, and in2007 to narrow the scope of FOIA exemptions and expand the scope ofinformation available to the public by the Freedom of Information Act.

H.R. 3802: The 1996 amendments to FOIA, sometimes named e-FOIA, extendedFOIA’s provisions to electronic records, and requires agencies to packageinformation electronically for any requester.

Openness Promotes Effectiveness in our National Government Act of 2007

(OPEN Government Act of 2007): Further modified FOIA by codifying into lawprovisions of the Executive Order 13392 and added a new office: the Office ofGovernment Information Services.

Review of the SEC’s Compliance with FOIA September 25, 2009

Review of the SEC’s Compliance with FOIA September 25, 2009

Report No. 465 Page 37 Appendix IV

List of Recommendations

Recommendation 1:

The Chairman’s Office shall fill the Chief FOIA Officer position with a qualifiedcandidate and ensure that the Chief FOIA Officer has the appropriate authority toimplement FOIA and to effectively fulfill the responsibilities outlined in the OPENGovernment Act of 2007.

Recommendation 2:

The Chairman’s Office shall communicate on an ongoing basis to Commission

employees and the public the importance of the Freedom of Information Act(FOIA) to the agency’s mission. This can be accomplished by updating theCommission’s FOIA webpage to emphasize the importance of FOIA to the public,and by issuing an SEC Administrative Notice to Commission employees on anannual basis.

• Accurate searches are made for responsive information that go beyond

information available in the databases,

• In the event of a denial to disclose information, documented evidence is

provided to certify that there was a document-by-document review to segregate responsive records.

Recommendation 4:

The Chairman’s Office shall direct the Chief Freedom of Information Act (FOIA)Officer to provide guidelines or written policies and procedures for all FOIArelated staff that specifically address the concerns raised in this review, asfollows:

• Discrimination towards some requesters;

Review of the SEC’s Compliance with FOIA September 25, 2009

Report No. 465 Page 38 • Confusion in assigning responsibility for redacting confidential information; • Disclosing information without consulting with the FOIA/PA office or the information source(s); • Mismanaging sensitive information; • Failure to comply with the time limitations requiring request to responses in 20-days; • Lack of opportunity for feedback, review, or approval of the final FOIA responses that are sent by the FOIA/PA office staff; and • Low priority given to FOIA responsibilities Commission-wide.

Recommendation 5:

The Office of General Counsel shall provide and enforce a clear policy of theseparation of roles and responsibilities and stipulate that the Office of GeneralCounsel lawyers who provide advice and counsel regarding any initial Freedomof Information Act request shall not participate in the appeal process.

Recommendation 6:

The Chairman’s Office shall direct the Chief Freedom of Information Act (FOIA)Officer to ensure that sufficient legal expertise is available to the Office ofFreedom of Information Act/Privacy Act Operations staff to process FOIArequests in compliance with the Freedom of Information Act, to correctly applythe exemptions, and to provide legal support to Commission staff regarding theAct.

Recommendation 7:

The Chairman’s Office shall direct the Chief Freedom of Information Act (FOIA)Officer to collaborate with the respective office and division managers and theOffice of Human Relations to review position descriptions of current Freedom ofInformation Act/Privacy Act (FOIA/PA) staff and FOIA liaisons to include staff’sappropriate FOIA task descriptions, performance standards, and review paygrades to ensure that they reflect actual FOIA responsibilities and duties.

Recommendation 8:

The Chairman’s Office shall direct the Chief Freedom of Information Act (FOIA)Officer to ensure that appropriate training opportunities are provided to allCommission staff that is appropriate for their level of FOIA responsibilities toeffectively and efficiently process FOIA requests.

Review of the SEC’s Compliance with FOIA September 25, 2009

Report No. 465 Page 39Recommendation 9:

The Chairman’s Office shall direct the Chief Freedom of Information Act (FOIA)Officer and the Office of Freedom of Information Act/Privacy Act Operations tocollaborate with the Office of the Secretary, the Division of Enforcement, and theOffice of Information Technology to produce a strategy that addressesinformation management obstacles hindering timely and comprehensive FOIAresponses. This strategy should contain concrete recommendations, specifictimelines, and cost estimates and should be presented to the Commission foraction.

Recommendation 10:

The Chairman’s Office shall direct the Chief Freedom of Information Act Officerto conduct training that is needed to fully implement the productive and suitableuse of the FOIAXpress tracking and document management system.

Office of Inspector General’s

Response to Management’s Comments

The Office of Inspector General is pleased that the Office of the Chairmanconcurred with the report’s 8 recommendations addressed to its office. We alsonote that the Office of the Chairman partially concurred with recommendation no.3. We believe that the Chairman’s Office proposed actions are responsive to ourfindings and recommendations and are encouraged that the Chairman’s Officehas already taken action to implement a key recommendation addressing theChief FOIA Officer position. 32 Once all the recommendations are fullyimplemented, we believe that the Commission’s FOIA processes will bestrengthened.

We are disappointed that the Office of General Counsel (OGC) has only partiallyconcurred with recommendations 3 33 and 5. We believe that both theserecommendations are crucial to ensuring that the public is able to obtaindocuments under FOIA in a transparent, complete and timely manner.

Recommendation no. 3 provides that where the SEC denies a request underFOIA, documented evidence should be provided to certify that there was adocument-by-document review to segregate responsive materials. We believethat it is important that the SEC complies with both the letter and spirit of theFOIA. Performing a document-by-document review is a necessary step toproperly withhold documents and to facilitate identification of segregabledocuments. As discussed in the report, although President Obama issued aMemorandum to the Heads of Executive Departments and Agencies on January21, 2009 directing FOIA to be administered with a “presumption in favor ofdisclosure,” the current SEC practices have the effect of creating a presumptionof withholding. It is also worth noting that in OGC’s comments to this report, itacknowledges that its position that a document-by-document review is notnecessary if an agency establishes categories of documents, has also beenrejected by a federal court. OGC continues to maintain this position even afterour review, and after this same federal court criticized the SEC for deliberatelystalling in fulfilling its obligations under FOIA in a published decision.

32 We note that the assertion that the Chief FOIA Officer position has been occupied continuouslywith senior-level staff is not entirely correct; the first assigned Chief FOIA Officer was not a seniorofficer. While subsequent Chief FOIA Officers may have been at the senior level, the major issueof the finding was that the position did not have sufficient support from the Commission toeffectively function as a Chief FOIA Officer.33 While recommendation no. 3 was directed to the Office of the Chairman, it was responded toby the Office of General Counsel.Review of the SEC’s Compliance with FOIA September 25, 2009Report No. 465

Page 50With respect to recommendation no. 5, we are disappointed that OGC isunwilling to enforce a clear separation of roles and responsibilities under theFOIA, and will continue its practice of having the same personnel who counselstaff during the initial FOIA request process later evaluating the appeal decision,notwithstanding the conflict. While the Administrative Procedure Act provisionsmay not strictly apply in a technical sense, the administrative principle of puttingin place safeguards to limit the authority and actions of staff to ensureaccountability, impartiality, and objectivity are particularly applicable to FOIA, andwe fear that continuing this practice will compromise the FOIA process anddeprive FOIA requesters from receiving an impartial and unbiased review duringan appeal.

Review of the SEC’s Compliance with FOIA September 25, 2009

Report No. 465 Page 51 Audit Requests and Ideas

The Office of Inspector General welcomes your input. If you would like torequest an audit in the future or have an audit idea, please contact us at: